1. Field of the Invention
The present invention relates to a mobile IP communication scheme, and more particularly, to a mobile computer device capable of carrying out communications while moving over networks in a system formed by a plurality of computers for providing necessary services by exchanging data among a plurality of inter-connected networks, and a mobile computer management device for managing a moving location information of the mobile computer and transferring packets destined to the mobile computer to a current location of the mobile computer, as well as a communication system and a mobile computer registration method suitable for these devices.
2. Description of the Background Art
In conjunction with availability of a computer system in smaller size and lower cost and a more enriched network environment, the use of computer system has been rapidly expanded into variety of fields, and there is also a transition from a centralized system to a distributed system. In this regard, in recent years, because of the advance and spread of the computer network technology in addition to the progress and improved performance of the computer system itself, it has become possible to realize not only a sharing of resources such as files and printers within an office but also communications (electronic mail, electronic news, file transfer etc.) with outside of an office or organization, and these communications are now widely used.
In particular, in recent years, the use of the world's largest computer network called “Internet” has become very popular, and there are new computer businesses for connecting to the Internet and utilizing open information and services, or for providing information and services to external users who make accesses through the Internet. In addition, new technology is developed in relation to the use of the Internet.
Also, in conjunction with the spread of such networks, there are technological developments regarding the mobile computing. In the mobile computing, a user carries along a portable computer terminal and makes communications while moving over networks. In some cases, the user may change a location on a network while continuing the communication, so that there is a need for a scheme that manages a changing address of a mobile computer on a network during such a communication in order to route the communication content correctly.
In general, in a case of realizing the mobile computing, a router (home agent) for managing the visiting site information of the mobile computer is provided at a network (home network) to which the mobile computer belongs, and when the mobile computer is away from the home network, the mobile computer sends a registration message for indicating a current location to this home agent. When this registration message is received, the transmission of data destined to the mobile computer is realized by capturing it by the home agent of the mobile computer, and carrying out the data routing control with respect to the mobile computer by encapsulating an IP packet destined to an original address of the mobile computer within a packet destined to a current location address of the mobile computer.
For example, in FIG. 1, this role is played by a home agent (HA) 5 in a case where the mobile computer 2 that originally belongs to the home network 1a moves to another network 1b and carries out the communication with another computer (correspondent host: CH) 3 within the other network 1c. This is a scheme called mobile IP which is currently in a process of being standardized by the mobile-IP working group of the IETF which is the standardizing organization for the Internet (see, IETF RFC 2002, IP mobility support (C. Perkins)).
Now, in the mobile IP scheme, when the mobile computer moves to a new visited site, there is a need to send a current location registration message to the home agent. Here, an authentication code according to a security information exchanged between the mobile computer and the home agent in advance is attached to the location registration message in order to avoid an attack such as pretending of the mobile computer. The location registration of the mobile computer will not take place if the registration message is not attached with the proper authentication code.
However, the security measure specified by the mobile IP is only the security in host (mobile computer) basis and does not authenticate an actual user who is using that mobile computer. Namely, if the host (mobile computer) itself is stolen by an improper user while the security information for the authentication between hosts is maintained within the host, it would be possible for the improper user to take out information on the home network by pretending the legitimate user so that it is very dangerous.
Also, even if it is not stolen, there is a possibility for the improper user to take out the secret information on the home network by just temporarily borrowing the mobile computer at which the registration processing is already carried out by the legitimate user.
In other words, the security measure in the conventional mobile IP scheme is capable of coping with the pretending attack in host basis, but quite vulnerable to the attack of an improper user pretending a legitimate user. For this reason, there has been possibilities for having the secret information on the internal network improperly taken out to a visited site (external network).
On the other hand, if the mobile computer is stolen, the home network information (such as an IP address of the home agent, its authentication key, addresses of a default router and internal hosts, for example) that is registered in that mobile computer will also be stolen together, so that various types of attacks might be induced based on such a stolen information. Thus, such an information from which the internal network information can be guessed should preferably be not maintained on the mobile computer as much as possible from a viewpoint of security, in order to prevent a security-wise very dangerous situation of having the mobile computer stolen together with the internal network information registered thereon.